IAB’s Newest Transparency and Consent Framework is Out—and Google is Finally on Board

The second version of the Transparency and Consent Framework (TCF) was released last week by the Interactive Advertising Bureau (IAB) Europe and the IAB Tech Lab—and it will finally be endorsed by Google.

The first version of TCF was released in April of last year, only one month before the start of the European Union’s General Data Protection Regulation (GDPR), which mandated that consumer consent for the use of ad targeting data had to be available and shared throughout the digital ad ecosystem.

The Consent String

To accomplish that task, the TCF established a consent string that would contain a user’s agreement for specific data and vendors. The consent string is made available during the ad bid request.

Although Google initially said it was supportive of TCF, IAB Tech Lab EVP and General Manager Dennis Buchheim noted that the tech giant “had some issues [about whether TCF 1.0 aligned] with their GDPR systems and policy,” and didn’t formally give its approval.

They have been “very involved” with the working groups that developed version 2.0, he said. Google now says it will integrate with the newest framework by the end of Q1 next year, which is when 2.0 is expected to be fully available. Version 2.0, however, is not backward compatible with the earlier incarnation.

One of Google’s initial concerns, Buchheim said, was that the purposes for data use were complicated for the user to understand. Version 2.0 now addresses that by allowing publishers to bundle purposes together, and users can drill down into the constituent purposes if they like.

Data Usage Purposes

There are now a dozen different data usage purposes, up from the previous version’s five, and more than 30 suggested bundled combinations.

For example, the 12 data usage purposes include storage/access for information, creation of a personalized ad profile, and creation of a personalized control profile. All of those purposes might be involved in, say, ad targeting, so the consent form might indicate to the user that the data is used in an “ad profile for targeting.”

The user can then examine the constituent data purposes inside that bundled description in ways determined by the website owner. Typically, the consent form pop-up would appear the first time a visitor came to the site and wouldn’t show up again unless the visitor decided they didn’t want the site to store any information for next time—and, next time, that visitor would again be seen as new.

In the consent form, a visitor might want to see what “ad profile for targeting” involves, and decide that they don’t want to permit, say, creation of a personalized control profile. The publisher might offer the option to disallow that use of info, and the publisher’s consent management system would have to decide if an “ad profile for targeting” is still possible.

Additionally, a publisher can now choose to include the data-using vendors it prefers right in the consent string. Previously, only consumer-approved vendors appeared in the consent string, and there was no available listing for which of those consumer-approved vendors the publisher preferred.

The consent string can also now indicate the relevant jurisdiction for a given transaction, such as this consent is originating in a transaction taking place in Germany. GDPR allows for different interpretations among the 28 EU markets.

‘Learned a Lot’

As in the previous TCF, the consent string can be used by a single publisher, shared with other vendors, and managed by the site’s custom or third-party consent management platform. The publisher determines what the user-facing consent form looks like, as long as the required information is adequately presented and the consent is properly captured and observed.

Buchheim said the IAB working groups have now “learned a lot” about how to address the concerns of GDPR, and he expects that the framework can “absolutely” be adapted to the upcoming requirements of the California Consumer Privacy Act (CCPA) and other state or country-level regulations.

At the moment, he added, the IAB groups don’t have complete stats on how widely the TCF has been adopted, but he noted that the global list of participating vendors has “several hundred” companies, at least a hundred thousand publishers, and is used in “at least” 25% of real-time online transactions by companies in the EU. Google’s acceptance of TCF 2.0 could help spur adoption among those companies, particularly the larger ones, that have been holding back.